I've removed automatic resend for those entries. The awkward bit is our identifier: it identifies the housing, not an inspection attempt. Two attempts can therefore produce the same label in the file.

Separate the physical housing identity from the attempt identity. Retain their relationship. Also define which component owns the decision that an uncertain attempt has been reconciled.

The software maintainer is drafting that decision with quality. We've added distinct attempt identities in the bench version, but old entries cannot acquire missing execution evidence by being renamed. Those are still held for review.

Include crashes around each durable write in the bench tests. A clean restart alone will not exercise the interval that caused this ambiguity. The older held entries remain a separate disposition question.